Terms and Conditions

As of: January 15, 2025

IMPORTANT — READ BEFORE ACCESSING OR USING

Do not use TrustSource (a Software-as-a-Service solution), or any associated materials and documentation (collectively, "TrustSource"), until you have carefully read the following Terms and Conditions (the "T&C"). By registering an account on the platform, you ("You" or "Licensee") acknowledge that you have carefully read, understood, and agree to be bound by the terms of this T&C.

If you do not wish to be bound by the terms of this T&C, please do not register or use this service or software.

This T&C is a legal agreement concerning TrustSource between you — as either a company within the meaning of § 14 BGB (German Civil Code), a single entity, or a corporate body of public law — and EACG Operations Services GmbH ("EOS"). This T&C supersedes and replaces any prior proposal, representation, or understanding you may have had with EOS relating to TrustSource.

TrustSource — even the free version — is not for private use!

1. Definitions

TrustSource

means the open source risk management SaaS solution provided by EACG Operations Services GmbH, Frankfurt am Main, to which this T&C applies. Also referred to below as the "Platform".

Scanner

means a computer program our users employ to automatically transfer structural information from their build process to us. Scanners are subject to their own terms of use (typically open source licenses).

Customer Data

means all data required for and provided by the customer for the performance of the contract.

Structural Data

means all data collected by a Scanner and transferred to the Platform.

Report Data

means all information generated on the Platform in the course of processing Structural Data.

Components

means pre-built building blocks, typically open source, used to compose the customer's individual solution.

User/Customer

means a business partner of EACG Operations Services GmbH who registers on the TrustSource platform, thereby accepting these terms of use.

Visitor

means an unidentified, potential user of the Platform who views and/or uses publicly accessible content on the Platform.

Knowledgebase

means a collection of information made available to visitors and users of the Platform.

2. Agreement / Pricing

The contractual relationship comes into existence when the customer registers a user account on the TrustSource platform. Use of the Platform is not possible without registering such a user account. This registration establishes a contract for the use of the TrustSource service and makes these terms, as well as the privacy policy, mandatorily accepted and part of the contractual relationship.

Concluding the contract entails use of the scanner software. The TrustSource platform API is publicly documented. Scanners may be freely built by any customer. Separate terms of use may apply to scanners already made available. The Platform contains a list of current scanners and the licenses associated with them.

Within the Platform, the customer may choose between different service tiers. Each selection establishes a contractual relationship for the chosen scope of service. There is no entitlement to any particular service — the customer is merely given the opportunity to sign up for specific services. The respective contract is concluded once the customer signs up.

In their user account, the customer can view their registration data and the data of each service they have selected, as well as subscribe to or cancel additional services.

Examples of additional services include: upgrading from a free to a corporate account, or adding an extended support agreement.

Pricing details are available on the website and are stated when the contract is concluded. Stated prices are net prices, plus statutory VAT at the applicable rate.

3. Confidentiality, Data Privacy and Intellectual Property

1. Customer Data containing specific information about the customer is protected; we may only access its content to the extent required to provide the services under this contract.

   We have prepared a separate privacy policy, which together with these terms governs compliance with data protection law within the contractual relationship. This policy is available at trustsource.io/en/privacy.

2. Usage rights:

   The customer receives a simple, non-exclusive right to use Report Data. They may use this measurement data solely within the scope of these terms. Publication for presentation or advertising purposes requires separate authorisation.

   The customer grants EOS a simple, non-exclusive right to use the Structural Data transferred to the Platform for the purpose of further processing and analysis in pursuit of the intended business purpose of open source risk management. We may continue to exercise these rights under this policy even in the event of changes to our corporate form.

3. By using the services, the customer accepts these terms and confirms that the confidentiality and data protection provisions of this contract meet their requirements.

4. Rights and Obligations of the User

1. The customer warrants that the data and information transferred by the scanner are in no way manipulated so as to produce a falsified evaluation result. The customer is liable to us for ensuring that neither the customer nor any third party manipulates such data or information, and indemnifies us against all related claims. The burden of proof that they are not responsible for manipulation by a third party lies with the customer.
2. The customer may only use the Platform in a manner that excludes harm. The customer warrants that they use our services, the Platform, and the scanners only for purposes that do not violate applicable law or the rights of third parties. In particular, the customer warrants that they do not store and/or make accessible to third parties any information that is unlawful or offensive, violates applicable data protection law, or infringes the rights of third parties.
3. The customer undertakes to keep access credentials (in particular passwords) confidential from unauthorised third parties.

   The customer undertakes to inform us without delay if there is reasonable suspicion that a third party has gained unauthorised knowledge of access credentials, or that the customer's access is being used without authorisation by a third party.

   The customer remains obliged to pay the agreed fees even in the event of unauthorised use of their customer data by a third party, unless the customer is not responsible for that unauthorised use. The burden of proof that they are not responsible lies with the customer.

   The customer undertakes to compensate us for any damage arising from unauthorised use of the customer's access credentials, unless the customer is not responsible for that unauthorised use. The burden of proof that they are not responsible lies with the customer.

4. The customer undertakes to notify us without delay of any disruptions in the use of TrustSource. We provide a dedicated email address for this purpose, which can be found on the TrustSource website under Contact.
5. The customer may use their own Structural Data or reports for their own purposes, e.g. publications. When publishing, the customer is obliged to credit TrustSource as the source.
6. The customer may use the TrustSource API provided by the Platform to represent their structural information and may embed the results online in their products, download them, print them for their own purposes, and reproduce them as needed. However, the customer may not attempt to block the API or other services provided by the Platform, deliberately overload them, or use them for any purpose other than the one provided.

   The customer may only use the API provided by the Platform to transmit structural information to the Platform.

5. Our Service Obligations

We provide the Platform. We grant the customer online access to their open source risk management. This currently comprises the following functional building blocks:

1. API for receiving structural information (scan)
2. Database for storing structural information
3. Component lists and license information
4. Information on open source components
5. Crawler for gathering additional information on open source components from bills of materials
6. Inference mechanism for identifying relevant legal provisions based on the transmitted structural information and project goals
7. Reports identifying known vulnerabilities, licenses in use, viability information, or relevant conditions to be fulfilled for use (checklist)
8. Interfaces to task management systems such as Microsoft TFS or Atlassian Jira
9. Mechanisms for managing and maintaining black- and white-lists at company, project, and module level
10. A rights system for securely designing multi-user access
11. An API for providing legally adequate documentation of the open source components in use

The Platform is provided in English. The Platform indicates which conditions arising from the licenses detected in the structural information must be fulfilled, or which conditions conflict with a use case specified by the customer. The Platform does not provide legal advice. For this purpose, we explicitly offer Extended Support through our legal partner.

We do not warrant the flawless operation of access to the Platform. We owe reasonable care to ensure access is not rendered inoperable for reasons within our area of responsibility.

We do not act as an internet service provider. The customer is responsible for providing and securing their own internet access.

6. Changes and Modifications

We reserve the right to modify our software and the TrustSource website at any time and without prior notice, provided this does not impair the functionality of the Platform.

7. Confidentiality

The confidentiality obligation covers all trade and business secrets that come to the customer's knowledge, as well as any other information designated as confidential and any know-how entrusted, obtained, or developed for the purpose of performing the contract, regardless of its form or the medium on which it is stored.

The customer undertakes to keep this information strictly confidential and not to disclose it to any third party. To fulfil this confidentiality obligation, the customer must take all necessary and reasonable measures.

The confidentiality obligation does not apply to information

• that was already publicly known or generally accessible,
• that was already known to the customer or that they lawfully obtained from a third party,
• whose disclosure we approve in writing.

In case of dispute, the customer bears the burden of proving that the information is not subject to the confidentiality obligation.

The confidentiality obligation applies for the duration of the respective individual contracts and, beyond that, for a period of 2 years after their termination.

8. Liability

TrustSource evaluates the licenses in use with respect to the stated use case and provides indications of unsuitable combinations and obligations to be fulfilled. However, this software-assisted evaluation can only provide an indication of compliance or non-compliance with the respective license terms. Given the possibility of incomplete delivery of structural information, no claim to completeness can be made. In individual cases, only a dedicated, manual review carried out by specialists can produce a clear attestation of conformity. TrustSource does not constitute legal advice and accordingly assumes no liability for any legal consequences arising from the use of open source for the user or their customers.

We are liable in accordance with statutory provisions for damages arising from intentional or grossly negligent breaches of contract, as well as fraudulent conduct, on our part or that of our legal representatives or vicarious agents; for damages arising from the breach of a guarantee we have assumed; and for damages arising from culpable injury to life, body, or health. In this case, liability for damages is limited to foreseeable, typically occurring damage, unless intent is present.

Any further liability is excluded regardless of the legal nature of the claim asserted; this applies in particular to tortious claims or claims for reimbursement of futile expenses instead of performance. Where liability is excluded or limited, this also applies to the personal liability of our employees, staff, representatives, and vicarious agents.

Except in cases of intent and gross negligence, we are not liable for damages that did not occur to the delivered item or the item worked on itself. In particular, we are not liable for lost profit or other financial losses of the user.

All claims of the user become time-barred after 12 months.

9. Risks Arising from the Use of Software and the Internet

Scanners are software components that run on the user's own systems. The customer either develops the scanners themselves or uses scanners already developed and made available as open source. We do not warrant the correct functioning of open source or self-developed scanners in use.

Communication between the scanner(s) and the TrustSource server system requires port 443 to be open in the firewall. Port 443 is typically open outbound for https: internet use. In certain data centre zones, however, this may not be desired. The user must assess this risk for their own system. We assume no liability for restrictions imposed by a firewall.

10. Termination / Changes to Subscription

1. Terminations require written form.

   Termination by the user:

   Users may terminate or downgrade their subscription as of the end of a subscription period, subject to the applicable notice period. The currently applicable models and notice periods are:

   • Free / none
   • Professional / monthly, 2 weeks before the end of the month
   • Corporate / quarterly, 4 weeks before the end of the quarter
   • Enterprise (subject to individual agreement)

   Termination by us:

   We are entitled to terminate with two months' notice to the end of a calendar month if the user repeatedly falls into arrears with amounts due on their account. Termination on this basis requires that we have first unsuccessfully requested payment from the user at least once, with a payment deadline of one week. The payment request may be made by letter, fax, or email; no particular form is required.

2. The right to extraordinary termination for good cause remains unaffected. Good cause for termination by us exists in particular if
   1. the customer's use endangers the operation or security of the Platform, or
   2. the user uses the TrustSource services, the Platform, or the scanners for purposes that violate applicable law and/or the rights of third parties.

11. Miscellaneous Concerning Our Service "Knowledgebase"

1. We provide all registered TrustSource users on the Platform, under the name "Knowledgebase", with background information on topics relating to open source in general, as well as usage guidance for the TrustSource services and best practices for handling licensing issues, known vulnerabilities, or critical components.

   This information and guidance, in the version currently available on the Platform, can be accessed and read by any visitor and user of the Platform. We do not warrant that this information and guidance will be available at all times.

2. We prepare this information to the best of our knowledge and update it to a reasonable extent. We do not warrant that this information is always up to date.

   Guidance on usage, methodology, and procedures is intended to assist users. We do not warrant that this guidance will lead to any particular result.

   Liability for the accuracy of content is assumed only in cases of intentional or grossly negligent conduct.

3. The copyright to all content published on the Platform, regardless of type or form, belongs solely to us or, where indicated accordingly, to the respective author or producer.

12. Miscellaneous Concerning Our Service "Standard Support"

1. We also offer customers from the Professional tier upward interactive support in using the TrustSource platform.

   "Support" means the handling and resolution of usage-related inquiries via the Platform, email, or phone. We provide the customer the opportunity to submit a support request during support hours. We process requests within the response time.

   Support does not include consulting, training, or coaching on legal or architectural questions relating to software development or design. These services can be purchased separately through an additional consulting agreement (see Extended Support).

2. Depending on the support agreement, we provide a support phone number or access to an online support system on the Platform.

   Where support is provided via a support phone number, a customer service agent can be reached at that number during the agreed support hours. Where this is not possible, for instance because all agents are already handling requests, a message may be left on a mailbox. Messages left on the mailbox are processed in order of receipt as soon as an agent becomes available.

   Where support is provided via the online support system, the customer receives their own access credentials upon registration and can submit support requests directly there.

3. The response time is set at 3 hours. Response time is the time between receipt of the support request and the start of processing by us. We generally guarantee this during service hours (Mon.–Fri. 9:00 a.m.–6:00 p.m. CET, excluding statutory public holidays in Germany).

   Where support staff cannot be reached directly by phone, the response time is 4 hours. Non-working days (public holidays and Sundays, German calendar) are not counted toward this time. If a support request is received outside support hours, the response time begins only at the start of the next support period.

4. It is the customer's responsibility to provide all relevant and necessary information for a support request that is required for advice and assistance in using the Platform.
5. We are not liable for any particular outcome of support. Liability for support is otherwise governed by the general provisions of this T&C.

13. Miscellaneous Concerning Our Service "Extended Support"

1. For customers with Corporate and Enterprise licenses, we offer the opportunity to purchase specialised consulting at a discounted hourly rate. This includes architecture consulting provided by EOS consultants (see eacg.de/eos).
2. Duration, notice periods, fees, and scope of services (e.g. response times) are governed by the respective individual agreements. The terms of Extended Support supplement these terms.

14. Governing Law / Jurisdiction

These terms and all legal relationships between EOS and the user/customer/visitor are governed by the law of the Federal Republic of Germany.

Only these terms apply to the use of the service and any resulting claims for remuneration; conflicting agreements do not apply.

The exclusive place of jurisdiction is Frankfurt am Main.